keloola / keloola-sso-authorize

v1.1.8 2026-11-02 08:33 UTC

Requires

• php: ^8.0|^8.2|^8.4
• illuminate/support: ^10.0|^11.0|^12|^13

Requires (Dev)

• orchestra/testbench: ^9.0|^10
• phpunit/phpunit: ^10.5|^11.0

MIT

• Roni Jakarianto

• keloola
• keloola-service-auth

Published on Packagist.org on 2026-11-02 08:44 UTC

README

Installation

You can install the package via composer:

composer require keloola/keloola-sso-authorize

Usage

Publish config :

php artisan vendor:publish --tag=keloola-auth-config

KELOOLA_AUTH_APP_ID=xxx //app id
KELOOLA_AUTH_SSO_HOST=https://accounts.keloola.xyz
KELOOLA_AUTH_CACHE_EXPIRED=60
KELOOLA_AUTH_ACCOUNTING_HOST=host api accounting
KELOOLA_AUTH_ACCOUNTING_ENCRYPT=false //jika accounting tidak di encrypt response dan request nya
KELOOLA_AUTH_ACCOUNTING_APP_KEY=xxx //jika encrypt true ini require dengan app key accounting

Setup Middleware Sso and Accounting

You can use on global middlware 

Location : project-laravel/bootstrap/app.php

use Keloola\KeloolaSsoAuthorize\Http\Middleware\KeloolaAuthMiddleware;

->withMiddleware(function (Middleware $middleware) {
       $middleware->api(append: [
            KeloolaAuthMiddleware::class,
        ]);
})

If you want to connect the keloola accounting , you must be use KeloolaAuthAccountingMiddleware

use Keloola\KeloolaSsoAuthorize\Http\Middleware\KeloolaAuthAccountingMiddleware;

Add before KeloolaAuthMiddleware::class


->withMiddleware(function (Middleware $middleware) {
       $middleware->api(append: [
            KeloolaAuthMiddleware::class,
            KeloolaAuthAccountingMiddleware::class, <----- disini
        ]);
})

or via routes

Route::middleware([KeloolaAuthMiddleware::class, KeloolaAuthAccountingMiddleware::class])
->group(function () {
    Route::get('/example', function () {
        return 'OK';
    });
});

Consume Data

Sso User Data 
$request->sso_user;

Accunting Data
$request->accounting_user

Testing

composer test

Changelog

Please see CHANGELOG for more information what has changed recently.

Contributing

Please see CONTRIBUTING for details.

Security

If you discover any security related issues, please email [e-mail] instead of using the issue tracker.

Credits

• Roni Jakarianto
• All Contributors

OAuth scope and permission middleware

For delegated integration endpoints, use the new keloola.scope middleware:

Route::post('/integrations/sales-orders', [SalesOrderController::class, 'store'])
    ->middleware('keloola.scope:accounting:sales-orders:write,sales_order.create');

Configure KELOOLA_AUTH_SSO_HOST and KELOOLA_AUTH_APP_ID for the resource app. The middleware calls SSO POST /api/oauth/access/check on every request (no cache). SSO verifies the token, current consent, active scope assignment, resource app, organization membership, and the user's permission for that operation.

Use verified context from $request->attributes->get('oauth_access') for user_id and organization_id. Always filter resource queries by that organization and apply your local data policies/business/subscription checks. Request input named oauth_access or sso_user is not verified context. Explicit organization_id in input or route must match the token organization.

This middleware does not log in a local Laravel user. Use it on dedicated integration routes; do not combine with legacy KeloolaAuthMiddleware, which serves browser sessions and rejects scoped OAuth profile responses. Missing or invalid credentials return 401, insufficient access 403, and unavailable or malformed SSO responses 503. No handler executes on failure.

Requires the SSO scope-catalog migration and /api/oauth/access/check endpoint. Legacy tokens without recorded scope consent cannot access these routes.

Internal application provisioning

Modul integrasi opt-in menyediakan route organisasi, anggota, role, permission, dan mirror undangan dengan autentikasi HMAC v1 dan penolakan replay. Gunakan direktori database bawaan atau implementasikan IntegrationHandler untuk model bisnis aplikasi. Modul tidak otomatis menulis tabel native aplikasi.

Lihat panduan konfigurasi dan integrasi dan kontrak OpenAPI. Instalasi lama tetap tidak mengekspos route baru sampai KELOOLA_SSO_INTEGRATION_ENABLED=true.